Live data from Hacker News

Converting Full Terraform Programs to Pulumi

pulumi.com

31–40 of 66 posts

Re: Converting Full Terraform Programs to Pulumi

#31
post #20

My biggest issue with Pulumi is that it doesn't have all of the guardrails/tools (like tfsec, tflint, and pavlov) to prevent newbies from doing bad things. I highly considered it for my team's project, but they are not mature enough developers for me to trust them not to massively screw things up or spend forever doing fairly simple things.

One of the big benefits of using an actual programming language rather than HCL is that it allows you to define abstractions / use the type system to enforce these invariants. I find this massively preferable to something like a linter in terms of being able to provide a nice API to engineers who might need a little more help defining their resources.

Or you could also use the cloud provider's api from a real programming language, or generate terraform code from it.

After having tried Pulumi I felt it does not bring the claimed pros, you need to write code in a non-idiomatic way, and coming up with abstractions for the representation of the stuff you talk about takes more time than just write proper terraform, and perform proper thorough reviews, which also facilitate knowledge sharing in the organization.

Also then you'd have 3 layers as sources of bugs, instead of just one: your code (you tested it properly, didn't you! How much time saved as opposed to just doing proper reviews!), pulumi itself (has faced its bugs on such a simple task as setting up an aws lambda), and terraform it uses under the hood.

In my experience pulumi doesn't solve problems for the business, but lets engineers waste time and money on playing around with their NIH abstractions. We tried it, and dumped it, and went back to terraform, which just works.

Re: Converting Full Terraform Programs to Pulumi

#33

Honest question, if you're locked in to AWS why not just use the CDK? I've used Terraform and Pulumi in the past and the "platform agnostic" is only true for trivial builds. Once you get into medium sized infra you're writing so much AWS specific code it stands better to go 1st party. I can't speak for GCP, but this is what happened to us. We kept fighting 3rd party code we ended up going CDK. While there are still i…

I have found Terraform or Pulumi to be very convenient even with a single cloud because they offer many cloud-agnostic features as well.

- random provider to generate a db password, cloud provider to provision db and admin user, random and mysql providers to provision additional non-admin users, k8s provider to upload credentials to secrets

- tls provider to create ca, k8s provider to create namespace, create certs for each k8s namespace, upload to k8s secrets

- Cloud provider to issue service account key, GitHub provider to upload to GHA (don't do this anymore since oidc is supported, before it was rather important)

While I haven't used CDK much, I believe it is still basically about provisioning aws resources and would not have such cross cutting configs, though I think they may have had a mechanism for importing tf providers.

Terraform can have its issues but overall being able to provision such diverse resources with a single command has been great for onboarding/reducing human error. I'm sure there are plenty of cases where CDK is easier too, these are just to demonstrate why you may use TF even when locked in.

Re: Converting Full Terraform Programs to Pulumi

#35

Honest question, if you're locked in to AWS why not just use the CDK? I've used Terraform and Pulumi in the past and the "platform agnostic" is only true for trivial builds. Once you get into medium sized infra you're writing so much AWS specific code it stands better to go 1st party. I can't speak for GCP, but this is what happened to us. We kept fighting 3rd party code we ended up going CDK. While there are still i…

When I switched from Azure to AWS I just had to learn AWS specifics and then could use my existing TF knowledge to put it in code. No need to learn CDK as well. If I ever end up working in GCP, it will hopefully be the same.

If you solely work with one cloud and don't intend on switching cloud providers or working in a context where multiple cloud providers are used, then by all means specialise. Personally I'm working as a software engineer, so I don't really care in which cloud it runs, as long as I can provision whatever resources I need.

Re: Converting Full Terraform Programs to Pulumi

#36
post #24
post #18

Earlier quoted context omitted.

You can use Pulumi for free. Also, the incremental cost for each resource is minuscule. Unless your experiments require thousands of resources, it really shouldn't be a big deterrent. Just clean up when you're done experimenting.

Sort of. You can use Pulumi for free as an individual. As a team you'd have to use a backend for your state other than Pulumi cloud, and your responsible for your own concurrency control [1]. In a team environment that's such a big foot gun I don't really consider it usable. That limitation makes Pulumi a nonstarter for me. Even if I am paying for it, this is super sensitive data and I want control over how it's stor…

I've not pushed the concurrency at all but I think it creates a lock file in storage which gives basic concurrency management.

The self hosted backend does have plenty of wringles though like not supporting the same stack name across different projects with the same backend URL contrary to how the hosted backend works.

Nonetheless it has been perfectly usable for us without paying for their hosting.

Re: Converting Full Terraform Programs to Pulumi

#38

I love the idea of IAC as actual code . Too many times I've looked at yet another over engineered templating engine and thought, why couldn't this just be code?

The reason for not doing a full programming language for that is that you can prove the infrastructure is finite with a simple template language, but you can’t if your template language can do conditional branching.

Or something like that. My CS-fu is admittedly weak.

OTOH, I think Lisp would be the perfect choice for IaC.

Re: Converting Full Terraform Programs to Pulumi

#39
post #20

My biggest issue with Pulumi is that it doesn't have all of the guardrails/tools (like tfsec, tflint, and pavlov) to prevent newbies from doing bad things. I highly considered it for my team's project, but they are not mature enough developers for me to trust them not to massively screw things up or spend forever doing fairly simple things.

One of the big benefits of using an actual programming language rather than HCL is that it allows you to define abstractions / use the type system to enforce these invariants. I find this massively preferable to something like a linter in terms of being able to provide a nice API to engineers who might need a little more help defining their resources.

A real language also presents more foot guns no?

In HCL it’s difficult to break repeatability, for example by querying external sources in an uncontrolled way.

Re: Converting Full Terraform Programs to Pulumi

#40
If devs write and maintain their own IAC then Pulumi is a good choice since they can write it in a familiar language.

If however a dedicated devops team has to manage it eventually, and there are multiple dev teams who all use different languages, then Terraform is better, since it’s practically impossible to learn all these languages. Terraform will give you a dumbed down enough lingua franca.

Also Terraform gives you the advantage to keep code complexity to a minimum. No chance to find some “clever” self referencing function or other language specific crazy stuff to solve a problem in it, it forces you to keep it simple.

Post reply on HN